Security Analysis and Re-engineering of Databases

This research and development project is aimed at dramatically improving the process of securing mission-critical databases residing in complex information system infrastructures against insider misuse. The improvements will be achieved through novel security analysis and re-engineering models and techniques applied to large scale commercial relational databases used in different application scenarios.

In the past two decades, there have been major advancements in the context of host- and network-based intrusion detection systems (IDS). In increasingly complex information system infrastructures such as those used in industry and by the government, IDS built the last line of defense against security threats such as denial-of-service attacks, tampering with the integrity and confidentiality of data, and theft and misuse of data. Current IDS models and approaches, however, fail to sufficiently protect sensitive data residing in databases from insider misuse, thus leaving open major issues in analysis and design of secure databases.

Approach

This project investigates models and techniques that help detect vulnerabilities, possible integrity threats, and misuse of privileges in relational databases. The ultimate goal is to embed these models and techniques into one coherent security analysis and re-engineering workbench for databases.

Activities include:

• Data Profiling. the behavior of mission-critical data in relations will be modeled and evaluated in terms of behavior of (aggregated) data metrics and access patterns over time. Data profiles reflecting the normal behavior of data will be discovered and database security mechanisms (such as integrity constraints) will be derived from such profiles to guard against anamalous data behavior.

• Correlating Data to Users and Applications. A novel concept of access path model will be discovered, and cluster information will be introduced where data behavior will be correlated to the behavior of users operating at the database, application, or operating system level. Focused auditi mechanisms will be devleoped to correlate behavioral patterns and to derive mechanisms at the database level to maintain and monitor access path profiles..

• User Profiling and Role Discovery. Using clustering and categorization approaches, similarities among behavioral aspects of different users and applications will be discovered, and cluster infomration will be utilized to (1) fully describe access paths from users to data, and (2) derive database roles that realize the least privilege paradigm for users and applications.

• Engineering Work and Studies. Several types of clustering and categorization algorithms will be developed and implemented to discover data and access path profiles. All algorithms and tools to derive database security mechanisms from profile specifications will be realized in a platform-independent workbench, which can be used with different commercial relational database management systems. Studies based on real world databases accessible to the PIs will evaluate the effectiveness and feasibility of the techniques to be developed.

Funding

NSF

Contact person:
Michael Gertz
gertz@cs.ucdavis.edu

last modified 5/10/04